Chapter 6 — Discrete structures
Lesson map
Lesson 06 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["6.1 Graphs"]
N2["6.2 Process trees"]
N3["6.3 Sets"]
N4["6.4 Logic of hypotheses"]
N5["6.5 Paths and reachability"]
N6["6.6 Relations"]
N7["6.7 Trees in file systems"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["6.1 Graphs"]
N2["6.2 Process trees"]
N3["6.3 Sets"]
N4["6.4 Logic of hypotheses"]
N5["6.5 Paths and reachability"]
N6["6.6 Relations"]
N7["6.7 Trees in file systems"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX016"]
[Learning outcomes]
|
v
[6.1 Graphs]
|
v
[6.2 Process trees]
|
v
[6.3 Sets]
|
v
[6.4 Logic of hypotheses]
|
v
[6.5 Paths and reachability]
|
v
[6.6 Relations]
|
v
[6.7 Trees in file systems]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) model relationships in evidence as graphs; (2) use sets for filtering artefacts; (3) apply simple logic to hypotheses; (4) represent process trees.
6.1 Graphs
A graph has nodes and edges. Emails form a graph of senders and recipients; processes form a tree of parents and children; hosts form a network graph of connections.
Writing data as a graph makes certain questions easy: who received an email from this sender, which processes descend from this one, which hosts did this machine connect to. Each of these is a walk along edges. For ws-114, the process tree and the connection graph together show how the incident unfolded and how far it may have spread.
6.2 Process trees
On ws-114, a spreadsheet application starts a command interpreter, which starts a system utility that loads a DLL. Drawn as a tree, the chain from document to suspicious library is obvious; listed by time, it is buried among other processes.
Each edge in the tree comes from a parent process identifier recorded in memory or in process-creation events. The spreadsheet starting a command interpreter is unusual in itself, since office documents rarely need one, which is why this branch stands out. Leah checks the start times along the chain: each child should start after its parent, and any gap between them is noted. The worked example below turns this tree into a figure with its sources named.
6.3 Sets
The set of files created during the incident window, intersected with the set of executables, gives a short list to examine.
For example, if forty files were created in the incident window and six executables exist in the user profile, the intersection might hold only two, which can be examined in detail. Set operations are easy to explain in a report because each step can be shown with its count. The examiner records the window boundaries used so the result can be reproduced.
6.4 Logic of hypotheses
Hypothesis H: "the spreadsheet launched the DLL". If H is true, the process tree should show a path from the spreadsheet to the utility that loaded the DLL. Absence of that path would weaken H; presence supports it but does not exclude other explanations.
An alternative explanation is that another process started rundll32 at the same time, and the spreadsheet link is a coincidence. Checking the parent process identifier in the memory capture and event logs distinguishes the two. Leah writes the alternative down before testing it, so the conclusion shows that it was considered and why it was rejected.
6.5 Paths and reachability
From the compromised workstation, which other hosts were contacted? Reachability in the connection graph lists them for checking.
Reachability gives the set of hosts that could have been affected, not those that were: a connection from ws-114 to a file server does not show that anything malicious happened there. Each host on the list is checked for matching signs, such as the same DLL hash or unusual logons from s.kaur's account. The list keeps the follow-up work bounded and documented.
6.6 Relations
"Created by" and "connected to" are relations; writing them down formally avoids ambiguity in reports.
For example, "rundll32 was created by cmd" uses the parent–child relation from the process list, while "ws-114 connected to the file server" uses a connection record. Naming the relation and its source in the report prevents a reader from confusing "created by" with "related to", which is much weaker and could mean almost anything. Leah keeps a short glossary of the relations used in her report, each with its source artefact, so the same phrase always carries the same meaning.
6.7 Trees in file systems
Directories form a tree; full paths are paths from the root.
Paths matter in reports because the same filename can appear in several folders. update.dll in a user's Downloads folder means something different from a file with the same name in a system directory. Leah always gives the full path, which identifies one node in the tree and lets a reader find it in the image. When she lists several files, she sorts them by path so files from the same folder appear together, which often shows that they arrived together.
Counting combinations
If an examiner must compare 30 suspicious files pairwise for similarity, there are 30 × 29 ÷ 2 = 435 pairs. Counting such work in advance helps plan time and choose tools.
Worked example
Leah draws ws-114's synthetic process tree: EXCEL → cmd → rundll32 (loading update.dll). She annotates each node with start time and source artefact. The figure becomes part of the report, with the caption naming the memory capture and event logs used.
Synthetic case. The tree is invented.
Errors and limits
Parent–child records can be incomplete if processes exited early or logging was off; gaps should be marked.
Exercises
- EX016 — Process path. Write the ws-114 process path. Rubric: 3 = EXCEL → cmd → rundll32 loading update.dll; 2 = partial; 1 = wrong order; 0 = none.
- EX017 — Set filter. Which set operation gives incident-window executables? Rubric: 3 = intersection of window files and executables; 2 = partial; 1 = union; 0 = none.
- EX018 — Hypothesis support. Does finding the path prove H? Rubric: 3 = supports, does not exclude alternatives; 2 = partial; 1 = proves; 0 = none.
Synthesis
Graphs, sets and logic make complex evidence readable and hypotheses testable.
Continue studying — chapter 06 of 40
← Chapter 05 (draft) · Course chapter index · Chapter 07 (draft) →